GHSA-j6wp-3859-vxfg

Suggest an improvement
Source
https://github.com/advisories/GHSA-j6wp-3859-vxfg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/11/GHSA-j6wp-3859-vxfg/GHSA-j6wp-3859-vxfg.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-j6wp-3859-vxfg
Aliases
Published
2021-11-10T16:52:24Z
Modified
2023-11-01T04:56:29.343354Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
OIDC claims not updated from Identity Provider in Pomerium
Details

Impact

Changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowed_idp_claims as part of policy. If using allowed_idp_claims and a user's claims are changed, Pomerium can make incorrect authorization decisions.

Patches

v0.15.6

Workarounds

  • Clear data on databroker service by clearing redis or restarting the in-memory databroker to force claims to be updated

References

https://github.com/pomerium/pomerium/pull/2724

For more information

If you have any questions or comments about this advisory: * Open an issue in Pomerium * Email us at security@pomerium.com

Database specific
{
    "nvd_published_at": "2021-11-05T23:15:00Z",
    "github_reviewed_at": "2021-11-08T21:37:07Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Go / github.com/pomerium/pomerium

Package

Name
github.com/pomerium/pomerium
View open source insights on deps.dev
Purl
pkg:golang/github.com/pomerium/pomerium

Affected ranges

Type
SEMVER
Events
Introduced
0.14.0
Fixed
0.15.6